Overview of the legal basis for processing personal data in the HR area


Purpose of the data processing

Aarhus University processes personal data for payroll and other administrative processes related to your employment.

Processing this information is authorised under  Article 6 and Article 9 of the General Data Protection Regulation and Section 12 of the Danish Data Protection Act.

Oplysningerne behandles med hjemmel i Databeskyttelsesforordningens artikel 6 og artikel 9 samt Databeskyttelseslovens § 12.

Types of employee data

Some types of information about the university’s employees are connected with the administration of their employment; other types of information are connected to the employees' access to IT systems and buildings; others are more closely connected with the tasks the employees perform, like meeting minutes or email addresses.

The types of employee data registered by the university are:
Name, civil registration number, address, salary seniority, collective agreement, employment contract, job advertisement, application with attachments (including curriculum vitae and diplomas/exam certificates), written agreements from SDD dialogues, holiday taken/remaining, special holidays, information about salary negotiations, citizenship, absence due to illness and other forms of absence, access cards, electronic equipment, keys, physical location.

The types of employee data that may be registered by the university, where relevant, include:
Lists of publications, teaching portfolio, references, maternity/paternity leave, adoption and parental leave, childcare days, any agreements concerning transfer of holidays, absence due to illness in connection with reimbursement, minutes from any sick leave absence interviews, minutes from any disciplinary meetings and any disciplinary sanctions, work permit, special offices (positions of trust), shift scheduling, any registration of working hours, use of the Danish Confederation of Professional Associations’ (AC organisation) free-choice scheme, free-choice pension scheme, senior staff scheme, increased tax rate, mileage allowance, free telephone, withholding of pay by SKAT (the Danish Customs and Tax Administration), parking permits, booking of houses through the Holiday Fund, psychological counselling by referral, course registrations, size of work clothes and shoes, identification photograph, information about tools and equipment the employee has been issued, contact information for next of kin.

Disclosure of personal data

Aarhus University only discloses personal data in cases in which there is a legal basis for doing so.

This may include disclosure of income information to the Danish Customs and Tax Administration (SKAT), as well as information about absence due to illness in connection with applications for municipal salary reimbursement.

In special cases, data is disclosed to other government agencies and institutions when necessary in connection with, for example, cooperation agreements with Central Denmark Region, reimbursements in connection with EU projects, ministries, foundations or the police.

The university discloses information about salary, salary supplements, reasons for salary supplements and information about work tasks to the union representative who is authorised to perform salary negotiations. The legal basis for such disclosure is Article 6(1) (c) of the General Data Protection Regulation and Section 12(1) or (2) of the Danish Data Protection Act.

The civil registration number and special (sensitive) personal data will only be disclosed to the union organisation/union representative authorised to negotiate with the express consent of the employee. The legal basis for this is Article 6(1)(a) and Article 9(2)(a) of the General Data Protection Regulation, and Section 12(3) of the Data Protection Act.

If personal data is processed in connection with a personality test, the legal basis for such processing is  Article 6(1)(e) of the General Data Protection Regulation.

The university obtains data from the employees themselves, from the National Registration Office, from the Danish Customs and Tax Administration (SKAT) and in some cases from other public sector authorities.

Data from employees themselves is obtained under the legal basis of Article 6(1)(b) of the General Data Protection Regulation.

Data from the National Registration Office, the Danish Customs and Tax Administration (SKAT) and from municipal authorities is obtained under the legal basis of Article 6(1) (c) of the General Data Protection Regulation and Section 12(1) of the Data Protection Act.

Following a specific case assessment, the university may decide to obtain criminal record disclosure in connection with recruitment, just as the university may obtain a statement of no previous convictions for offences involving children for employees who, as part of their work, will have direct contact with children and young people under 15 years of age.

Criminal record disclosure and statements of no previous convictions for offences involving children may be obtained on the legal basis of Article 10, cf. Article 6(2) and (3)(b) of the General Data Protection Regulation, cf. the Executive Order on the Processing of Personal Data in the Central Criminal Register, cf. Section 8(1) of the Data Protection Act.